CVE-2026-86897: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-86897 is an authorization bypass vulnerability in Apple's Safe Browsing component that allows an app to access sensitive user data due to insufficient entitlement checks. It was disclosed and patched on September 14, 2026, affecting Safari (before version 27), iOS and iPadOS (before 26.7 and before 27), macOS Golden Gate (before 27), and visionOS (before 27). The vulnerability was discovered by Stuart Wallace and is estimated to be of Medium severity; a formal CVSS score has not yet been published (base score listed as 0.0 in ENISA, pending NVD analysis) (Apple Safari 27, Apple iOS/iPadOS 26.7, Apple visionOS 27).

The root cause is insufficient entitlement checks within the Safe Browsing component across Apple platforms, classified as an authorization bypass (CWE-285 / improper authorization). Apple's fix involved adding additional entitlement checks to prevent apps from accessing data they are not entitled to. The vulnerability is present in the Safe Browsing subsystem of Safari and the underlying OS frameworks on iOS, iPadOS, macOS, and visionOS, meaning a locally installed app could bypass platform-enforced access controls to read sensitive user data without proper authorization (Apple Safari 27, Apple iOS/iPadOS 26.7, Apple visionOS 27).

A malicious or compromised app installed on an affected device could access sensitive user data that should be restricted by platform entitlements — specifically data associated with the Safe Browsing feature. The confidentiality impact is the primary concern, as unauthorized data access could expose browsing-related user information. Integrity and availability are not directly affected by this vulnerability (Apple iOS/iPadOS 26.7, Apple Safari 27).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation of CVE-2026-86897 at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a malicious app to be installed on the target device, limiting the attack surface to local app-based scenarios (Feedly).

Apple has released patches addressing this vulnerability across all affected platforms. Users and administrators should update to the following versions or later: Safari 27, iOS 26.7 or iOS 27, iPadOS 26.7 or iPadOS 27, macOS Golden Gate 27, and visionOS 27. No configuration-based workaround is available; updating to a patched release is the only recommended remediation. Additionally, reviewing installed apps and limiting installation to trusted sources reduces exposure (Apple Safari 27, Apple iOS/iPadOS 26.7, Apple macOS Golden Gate 27, Apple visionOS 27).